79aeb20e06ed62c3986034328cd3a6a5e08eb617cba4af679112640f786497da

Analysis

max time kernel
151s
max time network
156s
platform
windows7_x64
resource
win7v200430
submitted
24/06/2020, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WhatsAppImages.exe
Size 721KB
Sample200624-fe4dnyv85n
SHA256 79aeb20e06ed62c3986034328cd3a6a5e08eb617cba4af679112640f786497da
MD5 8b0261ae59f1de5e09528a36bbfc2564
SHA1 a93e7490eb196afd6d97f8b349b0240ef519aeb1
SHA512 285d1849fa52d2890072fbee53f72a819f883292399e65fe4c9cfc7f93d4a6b644221ab456a0949b56f784cfdde737d01fca3ce62ee9c18823a3f7e1886ebd57
MD5 SHA1 SHA512

Score

8^/10

evasion trojan persistence spyware

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	NAPSTAT.EXE

Suspicious use of WriteProcessMemory 251 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1384	1252	WhatsAppImages.exe	24
PID 1252 wrote to memory of 1384	1252	WhatsAppImages.exe	24
PID 1252 wrote to memory of 1384	1252	WhatsAppImages.exe	24
PID 1252 wrote to memory of 1384	1252	WhatsAppImages.exe	24
PID 1252 wrote to memory of 1436	1252	WhatsAppImages.exe	25
PID 1252 wrote to memory of 1436	1252	WhatsAppImages.exe	25
PID 1252 wrote to memory of 1436	1252	WhatsAppImages.exe	25
PID 1252 wrote to memory of 1436	1252	WhatsAppImages.exe	25
PID 1312 wrote to memory of 1516	1312	Explorer.EXE	26
PID 1312 wrote to memory of 1516	1312	Explorer.EXE	26
PID 1312 wrote to memory of 1516	1312	Explorer.EXE	26
PID 1312 wrote to memory of 1516	1312	Explorer.EXE	26
PID 1436 wrote to memory of 744	1436	WhatsAppImages.exe	27
PID 1436 wrote to memory of 744	1436	WhatsAppImages.exe	27
PID 1436 wrote to memory of 744	1436	WhatsAppImages.exe	27
PID 1436 wrote to memory of 744	1436	WhatsAppImages.exe	27
PID 1516 wrote to memory of 1092	1516	NAPSTAT.EXE	28
PID 1516 wrote to memory of 1092	1516	NAPSTAT.EXE	28
PID 1516 wrote to memory of 1092	1516	NAPSTAT.EXE	28
PID 1516 wrote to memory of 1092	1516	NAPSTAT.EXE	28
PID 744 wrote to memory of 1544	744	WhatsAppImages.exe	30
PID 744 wrote to memory of 1544	744	WhatsAppImages.exe	30
PID 744 wrote to memory of 1544	744	WhatsAppImages.exe	30
PID 744 wrote to memory of 1544	744	WhatsAppImages.exe	30
PID 744 wrote to memory of 1672	744	WhatsAppImages.exe	31
PID 744 wrote to memory of 1672	744	WhatsAppImages.exe	31
PID 744 wrote to memory of 1672	744	WhatsAppImages.exe	31
PID 744 wrote to memory of 1672	744	WhatsAppImages.exe	31
PID 1312 wrote to memory of 1332	1312	Explorer.EXE	32
PID 1312 wrote to memory of 1332	1312	Explorer.EXE	32
PID 1312 wrote to memory of 1332	1312	Explorer.EXE	32
PID 1312 wrote to memory of 1332	1312	Explorer.EXE	32
PID 1672 wrote to memory of 1792	1672	WhatsAppImages.exe	33
PID 1672 wrote to memory of 1792	1672	WhatsAppImages.exe	33
PID 1672 wrote to memory of 1792	1672	WhatsAppImages.exe	33
PID 1672 wrote to memory of 1792	1672	WhatsAppImages.exe	33
PID 1792 wrote to memory of 308	1792	WhatsAppImages.exe	36
PID 1792 wrote to memory of 308	1792	WhatsAppImages.exe	36
PID 1792 wrote to memory of 308	1792	WhatsAppImages.exe	36
PID 1792 wrote to memory of 308	1792	WhatsAppImages.exe	36
PID 1792 wrote to memory of 1284	1792	WhatsAppImages.exe	37
PID 1792 wrote to memory of 1284	1792	WhatsAppImages.exe	37
PID 1792 wrote to memory of 1284	1792	WhatsAppImages.exe	37
PID 1792 wrote to memory of 1284	1792	WhatsAppImages.exe	37
PID 1312 wrote to memory of 1532	1312	Explorer.EXE	38
PID 1312 wrote to memory of 1532	1312	Explorer.EXE	38
PID 1312 wrote to memory of 1532	1312	Explorer.EXE	38
PID 1312 wrote to memory of 1532	1312	Explorer.EXE	38
PID 1284 wrote to memory of 856	1284	WhatsAppImages.exe	39
PID 1284 wrote to memory of 856	1284	WhatsAppImages.exe	39
PID 1284 wrote to memory of 856	1284	WhatsAppImages.exe	39
PID 1284 wrote to memory of 856	1284	WhatsAppImages.exe	39
PID 856 wrote to memory of 1576	856	WhatsAppImages.exe	40
PID 856 wrote to memory of 1576	856	WhatsAppImages.exe	40
PID 856 wrote to memory of 1576	856	WhatsAppImages.exe	40
PID 856 wrote to memory of 1576	856	WhatsAppImages.exe	40
PID 856 wrote to memory of 1612	856	WhatsAppImages.exe	41
PID 856 wrote to memory of 1612	856	WhatsAppImages.exe	41
PID 856 wrote to memory of 1612	856	WhatsAppImages.exe	41
PID 856 wrote to memory of 1612	856	WhatsAppImages.exe	41
PID 1312 wrote to memory of 1540	1312	Explorer.EXE	42
PID 1312 wrote to memory of 1540	1312	Explorer.EXE	42
PID 1312 wrote to memory of 1540	1312	Explorer.EXE	42
PID 1312 wrote to memory of 1540	1312	Explorer.EXE	42
PID 1612 wrote to memory of 1500	1612	WhatsAppImages.exe	43
PID 1612 wrote to memory of 1500	1612	WhatsAppImages.exe	43
PID 1612 wrote to memory of 1500	1612	WhatsAppImages.exe	43
PID 1612 wrote to memory of 1500	1612	WhatsAppImages.exe	43
PID 1500 wrote to memory of 1884	1500	WhatsAppImages.exe	44
PID 1500 wrote to memory of 1884	1500	WhatsAppImages.exe	44
PID 1500 wrote to memory of 1884	1500	WhatsAppImages.exe	44
PID 1500 wrote to memory of 1884	1500	WhatsAppImages.exe	44
PID 1500 wrote to memory of 1860	1500	WhatsAppImages.exe	45
PID 1500 wrote to memory of 1860	1500	WhatsAppImages.exe	45
PID 1500 wrote to memory of 1860	1500	WhatsAppImages.exe	45
PID 1500 wrote to memory of 1860	1500	WhatsAppImages.exe	45
PID 1312 wrote to memory of 1968	1312	Explorer.EXE	46
PID 1312 wrote to memory of 1968	1312	Explorer.EXE	46
PID 1312 wrote to memory of 1968	1312	Explorer.EXE	46
PID 1312 wrote to memory of 1968	1312	Explorer.EXE	46
PID 1860 wrote to memory of 1956	1860	WhatsAppImages.exe	47
PID 1860 wrote to memory of 1956	1860	WhatsAppImages.exe	47
PID 1860 wrote to memory of 1956	1860	WhatsAppImages.exe	47
PID 1860 wrote to memory of 1956	1860	WhatsAppImages.exe	47
PID 1956 wrote to memory of 1936	1956	WhatsAppImages.exe	48
PID 1956 wrote to memory of 1936	1956	WhatsAppImages.exe	48
PID 1956 wrote to memory of 1936	1956	WhatsAppImages.exe	48
PID 1956 wrote to memory of 1936	1956	WhatsAppImages.exe	48
PID 1956 wrote to memory of 1064	1956	WhatsAppImages.exe	49
PID 1956 wrote to memory of 1064	1956	WhatsAppImages.exe	49
PID 1956 wrote to memory of 1064	1956	WhatsAppImages.exe	49
PID 1956 wrote to memory of 1064	1956	WhatsAppImages.exe	49
PID 1312 wrote to memory of 336	1312	Explorer.EXE	50
PID 1312 wrote to memory of 336	1312	Explorer.EXE	50
PID 1312 wrote to memory of 336	1312	Explorer.EXE	50
PID 1312 wrote to memory of 336	1312	Explorer.EXE	50
PID 1064 wrote to memory of 1736	1064	WhatsAppImages.exe	51
PID 1064 wrote to memory of 1736	1064	WhatsAppImages.exe	51
PID 1064 wrote to memory of 1736	1064	WhatsAppImages.exe	51
PID 1064 wrote to memory of 1736	1064	WhatsAppImages.exe	51
PID 1736 wrote to memory of 612	1736	WhatsAppImages.exe	52
PID 1736 wrote to memory of 612	1736	WhatsAppImages.exe	52
PID 1736 wrote to memory of 612	1736	WhatsAppImages.exe	52
PID 1736 wrote to memory of 612	1736	WhatsAppImages.exe	52
PID 1736 wrote to memory of 1480	1736	WhatsAppImages.exe	53
PID 1736 wrote to memory of 1480	1736	WhatsAppImages.exe	53
PID 1736 wrote to memory of 1480	1736	WhatsAppImages.exe	53
PID 1736 wrote to memory of 1480	1736	WhatsAppImages.exe	53
PID 1312 wrote to memory of 1264	1312	Explorer.EXE	54
PID 1312 wrote to memory of 1264	1312	Explorer.EXE	54
PID 1312 wrote to memory of 1264	1312	Explorer.EXE	54
PID 1312 wrote to memory of 1264	1312	Explorer.EXE	54
PID 1480 wrote to memory of 1420	1480	WhatsAppImages.exe	55
PID 1480 wrote to memory of 1420	1480	WhatsAppImages.exe	55
PID 1480 wrote to memory of 1420	1480	WhatsAppImages.exe	55
PID 1480 wrote to memory of 1420	1480	WhatsAppImages.exe	55
PID 1420 wrote to memory of 1444	1420	WhatsAppImages.exe	56
PID 1420 wrote to memory of 1444	1420	WhatsAppImages.exe	56
PID 1420 wrote to memory of 1444	1420	WhatsAppImages.exe	56
PID 1420 wrote to memory of 1444	1420	WhatsAppImages.exe	56
PID 1420 wrote to memory of 1096	1420	WhatsAppImages.exe	57
PID 1420 wrote to memory of 1096	1420	WhatsAppImages.exe	57
PID 1420 wrote to memory of 1096	1420	WhatsAppImages.exe	57
PID 1420 wrote to memory of 1096	1420	WhatsAppImages.exe	57
PID 1312 wrote to memory of 1660	1312	Explorer.EXE	58
PID 1312 wrote to memory of 1660	1312	Explorer.EXE	58
PID 1312 wrote to memory of 1660	1312	Explorer.EXE	58
PID 1312 wrote to memory of 1660	1312	Explorer.EXE	58
PID 1096 wrote to memory of 1072	1096	WhatsAppImages.exe	59
PID 1096 wrote to memory of 1072	1096	WhatsAppImages.exe	59
PID 1096 wrote to memory of 1072	1096	WhatsAppImages.exe	59
PID 1096 wrote to memory of 1072	1096	WhatsAppImages.exe	59
PID 1072 wrote to memory of 1336	1072	WhatsAppImages.exe	60
PID 1072 wrote to memory of 1336	1072	WhatsAppImages.exe	60
PID 1072 wrote to memory of 1336	1072	WhatsAppImages.exe	60
PID 1072 wrote to memory of 1336	1072	WhatsAppImages.exe	60
PID 1072 wrote to memory of 1664	1072	WhatsAppImages.exe	61
PID 1072 wrote to memory of 1664	1072	WhatsAppImages.exe	61
PID 1072 wrote to memory of 1664	1072	WhatsAppImages.exe	61
PID 1072 wrote to memory of 1664	1072	WhatsAppImages.exe	61
PID 1312 wrote to memory of 1036	1312	Explorer.EXE	62
PID 1312 wrote to memory of 1036	1312	Explorer.EXE	62
PID 1312 wrote to memory of 1036	1312	Explorer.EXE	62
PID 1312 wrote to memory of 1036	1312	Explorer.EXE	62
PID 1664 wrote to memory of 644	1664	WhatsAppImages.exe	63
PID 1664 wrote to memory of 644	1664	WhatsAppImages.exe	63
PID 1664 wrote to memory of 644	1664	WhatsAppImages.exe	63
PID 1664 wrote to memory of 644	1664	WhatsAppImages.exe	63
PID 644 wrote to memory of 1788	644	WhatsAppImages.exe	64
PID 644 wrote to memory of 1788	644	WhatsAppImages.exe	64
PID 644 wrote to memory of 1788	644	WhatsAppImages.exe	64
PID 644 wrote to memory of 1788	644	WhatsAppImages.exe	64
PID 644 wrote to memory of 1260	644	WhatsAppImages.exe	65
PID 644 wrote to memory of 1260	644	WhatsAppImages.exe	65
PID 644 wrote to memory of 1260	644	WhatsAppImages.exe	65
PID 644 wrote to memory of 1260	644	WhatsAppImages.exe	65
PID 1312 wrote to memory of 752	1312	Explorer.EXE	66
PID 1312 wrote to memory of 752	1312	Explorer.EXE	66
PID 1312 wrote to memory of 752	1312	Explorer.EXE	66
PID 1312 wrote to memory of 752	1312	Explorer.EXE	66
PID 1260 wrote to memory of 1600	1260	WhatsAppImages.exe	68
PID 1260 wrote to memory of 1600	1260	WhatsAppImages.exe	68
PID 1260 wrote to memory of 1600	1260	WhatsAppImages.exe	68
PID 1260 wrote to memory of 1600	1260	WhatsAppImages.exe	68
PID 1516 wrote to memory of 2000	1516	NAPSTAT.EXE	69
PID 1516 wrote to memory of 2000	1516	NAPSTAT.EXE	69
PID 1516 wrote to memory of 2000	1516	NAPSTAT.EXE	69
PID 1516 wrote to memory of 2000	1516	NAPSTAT.EXE	69
PID 1600 wrote to memory of 1496	1600	WhatsAppImages.exe	70
PID 1600 wrote to memory of 1496	1600	WhatsAppImages.exe	70
PID 1600 wrote to memory of 1496	1600	WhatsAppImages.exe	70
PID 1600 wrote to memory of 1496	1600	WhatsAppImages.exe	70
PID 1600 wrote to memory of 1904	1600	WhatsAppImages.exe	71
PID 1600 wrote to memory of 1904	1600	WhatsAppImages.exe	71
PID 1600 wrote to memory of 1904	1600	WhatsAppImages.exe	71
PID 1600 wrote to memory of 1904	1600	WhatsAppImages.exe	71
PID 1312 wrote to memory of 1920	1312	Explorer.EXE	72
PID 1312 wrote to memory of 1920	1312	Explorer.EXE	72
PID 1312 wrote to memory of 1920	1312	Explorer.EXE	72
PID 1312 wrote to memory of 1920	1312	Explorer.EXE	72
PID 1312 wrote to memory of 1920	1312	Explorer.EXE	72
PID 1312 wrote to memory of 1920	1312	Explorer.EXE	72
PID 1312 wrote to memory of 1920	1312	Explorer.EXE	72
PID 1516 wrote to memory of 2000	1516	NAPSTAT.EXE	69
PID 1904 wrote to memory of 1948	1904	WhatsAppImages.exe	73
PID 1904 wrote to memory of 1948	1904	WhatsAppImages.exe	73
PID 1904 wrote to memory of 1948	1904	WhatsAppImages.exe	73
PID 1904 wrote to memory of 1948	1904	WhatsAppImages.exe	73
PID 1948 wrote to memory of 2020	1948	WhatsAppImages.exe	74
PID 1948 wrote to memory of 2020	1948	WhatsAppImages.exe	74
PID 1948 wrote to memory of 2020	1948	WhatsAppImages.exe	74
PID 1948 wrote to memory of 2020	1948	WhatsAppImages.exe	74
PID 1948 wrote to memory of 840	1948	WhatsAppImages.exe	75
PID 1948 wrote to memory of 840	1948	WhatsAppImages.exe	75
PID 1948 wrote to memory of 840	1948	WhatsAppImages.exe	75
PID 1948 wrote to memory of 840	1948	WhatsAppImages.exe	75
PID 1312 wrote to memory of 1668	1312	Explorer.EXE	76
PID 1312 wrote to memory of 1668	1312	Explorer.EXE	76
PID 1312 wrote to memory of 1668	1312	Explorer.EXE	76
PID 1312 wrote to memory of 1668	1312	Explorer.EXE	76
PID 840 wrote to memory of 2012	840	WhatsAppImages.exe	77
PID 840 wrote to memory of 2012	840	WhatsAppImages.exe	77
PID 840 wrote to memory of 2012	840	WhatsAppImages.exe	77
PID 840 wrote to memory of 2012	840	WhatsAppImages.exe	77
PID 2012 wrote to memory of 1472	2012	WhatsAppImages.exe	78
PID 2012 wrote to memory of 1472	2012	WhatsAppImages.exe	78
PID 2012 wrote to memory of 1472	2012	WhatsAppImages.exe	78
PID 2012 wrote to memory of 1472	2012	WhatsAppImages.exe	78
PID 2012 wrote to memory of 1524	2012	WhatsAppImages.exe	79
PID 2012 wrote to memory of 1524	2012	WhatsAppImages.exe	79
PID 2012 wrote to memory of 1524	2012	WhatsAppImages.exe	79
PID 2012 wrote to memory of 1524	2012	WhatsAppImages.exe	79
PID 1312 wrote to memory of 1520	1312	Explorer.EXE	80
PID 1312 wrote to memory of 1520	1312	Explorer.EXE	80
PID 1312 wrote to memory of 1520	1312	Explorer.EXE	80
PID 1312 wrote to memory of 1520	1312	Explorer.EXE	80
PID 1524 wrote to memory of 1512	1524	WhatsAppImages.exe	81
PID 1524 wrote to memory of 1512	1524	WhatsAppImages.exe	81
PID 1524 wrote to memory of 1512	1524	WhatsAppImages.exe	81
PID 1524 wrote to memory of 1512	1524	WhatsAppImages.exe	81
PID 1512 wrote to memory of 1420	1512	WhatsAppImages.exe	82
PID 1512 wrote to memory of 1420	1512	WhatsAppImages.exe	82
PID 1512 wrote to memory of 1420	1512	WhatsAppImages.exe	82
PID 1512 wrote to memory of 1420	1512	WhatsAppImages.exe	82
PID 1512 wrote to memory of 1608	1512	WhatsAppImages.exe	83
PID 1512 wrote to memory of 1608	1512	WhatsAppImages.exe	83
PID 1512 wrote to memory of 1608	1512	WhatsAppImages.exe	83
PID 1512 wrote to memory of 1608	1512	WhatsAppImages.exe	83
PID 1312 wrote to memory of 1096	1312	Explorer.EXE	84
PID 1312 wrote to memory of 1096	1312	Explorer.EXE	84
PID 1312 wrote to memory of 1096	1312	Explorer.EXE	84
PID 1312 wrote to memory of 1096	1312	Explorer.EXE	84
PID 1312 wrote to memory of 1096	1312	Explorer.EXE	84
PID 1312 wrote to memory of 1096	1312	Explorer.EXE	84
PID 1312 wrote to memory of 1096	1312	Explorer.EXE	84
PID 1608 wrote to memory of 1636	1608	WhatsAppImages.exe	85
PID 1608 wrote to memory of 1636	1608	WhatsAppImages.exe	85
PID 1608 wrote to memory of 1636	1608	WhatsAppImages.exe	85
PID 1608 wrote to memory of 1636	1608	WhatsAppImages.exe	85
PID 1636 wrote to memory of 1492	1636	WhatsAppImages.exe	86
PID 1636 wrote to memory of 1492	1636	WhatsAppImages.exe	86
PID 1636 wrote to memory of 1492	1636	WhatsAppImages.exe	86
PID 1636 wrote to memory of 1492	1636	WhatsAppImages.exe	86
PID 1636 wrote to memory of 1536	1636	WhatsAppImages.exe	87
PID 1636 wrote to memory of 1536	1636	WhatsAppImages.exe	87
PID 1636 wrote to memory of 1536	1636	WhatsAppImages.exe	87
PID 1636 wrote to memory of 1536	1636	WhatsAppImages.exe	87
PID 1312 wrote to memory of 1260	1312	Explorer.EXE	90
PID 1312 wrote to memory of 1260	1312	Explorer.EXE	90
PID 1312 wrote to memory of 1260	1312	Explorer.EXE	90
PID 1312 wrote to memory of 1260	1312	Explorer.EXE	90

Suspicious use of SetThreadContext 37 IoCs

description	pid	Process	procid_target
PID 1252 set thread context of 1384	1252	WhatsAppImages.exe	24
PID 1384 set thread context of 1312	1384	WhatsAppImages.exe	20
PID 1384 set thread context of 1312	1384	WhatsAppImages.exe	20
PID 744 set thread context of 1544	744	WhatsAppImages.exe	30
PID 1544 set thread context of 1312	1544	WhatsAppImages.exe	20
PID 1516 set thread context of 1312	1516	NAPSTAT.EXE	20
PID 1792 set thread context of 308	1792	WhatsAppImages.exe	36
PID 308 set thread context of 1312	308	WhatsAppImages.exe	20
PID 308 set thread context of 1312	308	WhatsAppImages.exe	20
PID 856 set thread context of 1576	856	WhatsAppImages.exe	40
PID 1576 set thread context of 1312	1576	WhatsAppImages.exe	20
PID 1500 set thread context of 1884	1500	WhatsAppImages.exe	44
PID 1884 set thread context of 1312	1884	WhatsAppImages.exe	20
PID 1956 set thread context of 1936	1956	WhatsAppImages.exe	48
PID 1936 set thread context of 1312	1936	WhatsAppImages.exe	20
PID 1936 set thread context of 1312	1936	WhatsAppImages.exe	20
PID 1736 set thread context of 612	1736	WhatsAppImages.exe	52
PID 612 set thread context of 1312	612	WhatsAppImages.exe	20
PID 1420 set thread context of 1444	1420	WhatsAppImages.exe	56
PID 1444 set thread context of 1312	1444	WhatsAppImages.exe	20
PID 1072 set thread context of 1336	1072	WhatsAppImages.exe	60
PID 1336 set thread context of 1312	1336	WhatsAppImages.exe	20
PID 644 set thread context of 1788	644	WhatsAppImages.exe	64
PID 1788 set thread context of 1312	1788	WhatsAppImages.exe	20
PID 1600 set thread context of 1496	1600	WhatsAppImages.exe	70
PID 1496 set thread context of 1312	1496	WhatsAppImages.exe	20
PID 1948 set thread context of 2020	1948	WhatsAppImages.exe	74
PID 2020 set thread context of 1312	2020	WhatsAppImages.exe	20
PID 2020 set thread context of 1312	2020	WhatsAppImages.exe	20
PID 2012 set thread context of 1472	2012	WhatsAppImages.exe	78
PID 1472 set thread context of 1312	1472	WhatsAppImages.exe	20
PID 1512 set thread context of 1420	1512	WhatsAppImages.exe	82
PID 1420 set thread context of 1312	1420	WhatsAppImages.exe	20
PID 1420 set thread context of 1312	1420	WhatsAppImages.exe	20
PID 1636 set thread context of 1492	1636	WhatsAppImages.exe	86
PID 1492 set thread context of 1312	1492	WhatsAppImages.exe	20
PID 1492 set thread context of 1312	1492	WhatsAppImages.exe	20

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	WhatsAppImages.exe
Token: SeDebugPrivilege	1516	NAPSTAT.EXE
Token: SeDebugPrivilege	1544	WhatsAppImages.exe
Token: SeDebugPrivilege	1332	wininit.exe
Token: SeDebugPrivilege	308	WhatsAppImages.exe
Token: SeDebugPrivilege	1532	NAPSTAT.EXE
Token: SeDebugPrivilege	1576	WhatsAppImages.exe
Token: SeDebugPrivilege	1540	explorer.exe
Token: SeDebugPrivilege	1884	WhatsAppImages.exe
Token: SeDebugPrivilege	1968	control.exe
Token: SeDebugPrivilege	1936	WhatsAppImages.exe
Token: SeDebugPrivilege	336	svchost.exe
Token: SeDebugPrivilege	612	WhatsAppImages.exe
Token: SeDebugPrivilege	1264	colorcpl.exe
Token: SeDebugPrivilege	1444	WhatsAppImages.exe
Token: SeDebugPrivilege	1660	chkdsk.exe
Token: SeDebugPrivilege	1336	WhatsAppImages.exe
Token: SeDebugPrivilege	1036	svchost.exe
Token: SeDebugPrivilege	1788	WhatsAppImages.exe
Token: SeDebugPrivilege	752	msdt.exe
Token: SeDebugPrivilege	1496	WhatsAppImages.exe
Token: SeDebugPrivilege	1920	msiexec.exe
Token: SeDebugPrivilege	2020	WhatsAppImages.exe
Token: SeDebugPrivilege	1668	cmmon32.exe
Token: SeDebugPrivilege	1472	WhatsAppImages.exe
Token: SeDebugPrivilege	1520	netsh.exe
Token: SeDebugPrivilege	1420	WhatsAppImages.exe
Token: SeDebugPrivilege	1096	msiexec.exe
Token: SeDebugPrivilege	1492	WhatsAppImages.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Swpj8fn\chkdskjvxxkzix.exe	NAPSTAT.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	NAPSTAT.EXE

Suspicious behavior: MapViewOfSection 68 IoCs

pid	Process
1252	WhatsAppImages.exe
1384	WhatsAppImages.exe
1384	WhatsAppImages.exe
1384	WhatsAppImages.exe
1384	WhatsAppImages.exe
1516	NAPSTAT.EXE
744	WhatsAppImages.exe
1544	WhatsAppImages.exe
1516	NAPSTAT.EXE
1544	WhatsAppImages.exe
1544	WhatsAppImages.exe
1792	WhatsAppImages.exe
308	WhatsAppImages.exe
308	WhatsAppImages.exe
308	WhatsAppImages.exe
308	WhatsAppImages.exe
856	WhatsAppImages.exe
1576	WhatsAppImages.exe
1576	WhatsAppImages.exe
1576	WhatsAppImages.exe
1500	WhatsAppImages.exe
1884	WhatsAppImages.exe
1884	WhatsAppImages.exe
1884	WhatsAppImages.exe
1956	WhatsAppImages.exe
1936	WhatsAppImages.exe
1936	WhatsAppImages.exe
1936	WhatsAppImages.exe
1936	WhatsAppImages.exe
1736	WhatsAppImages.exe
612	WhatsAppImages.exe
612	WhatsAppImages.exe
612	WhatsAppImages.exe
1420	WhatsAppImages.exe
1444	WhatsAppImages.exe
1444	WhatsAppImages.exe
1444	WhatsAppImages.exe
1072	WhatsAppImages.exe
1336	WhatsAppImages.exe
1336	WhatsAppImages.exe
1336	WhatsAppImages.exe
644	WhatsAppImages.exe
1788	WhatsAppImages.exe
1788	WhatsAppImages.exe
1788	WhatsAppImages.exe
1516	NAPSTAT.EXE
1600	WhatsAppImages.exe
1496	WhatsAppImages.exe
1516	NAPSTAT.EXE
1496	WhatsAppImages.exe
1496	WhatsAppImages.exe
1948	WhatsAppImages.exe
2020	WhatsAppImages.exe
2020	WhatsAppImages.exe
2020	WhatsAppImages.exe
2020	WhatsAppImages.exe
2012	WhatsAppImages.exe
1472	WhatsAppImages.exe
1472	WhatsAppImages.exe
1472	WhatsAppImages.exe
1512	WhatsAppImages.exe
1420	WhatsAppImages.exe
1420	WhatsAppImages.exe
1420	WhatsAppImages.exe
1420	WhatsAppImages.exe
1636	WhatsAppImages.exe
1492	WhatsAppImages.exe
1492	WhatsAppImages.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Adds Run entry to policy start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	NAPSTAT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ERZXJ2EHUB = "C:\\Program Files (x86)\\Swpj8fn\\chkdskjvxxkzix.exe"	NAPSTAT.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 910 IoCs

pid	Process
1252	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1384	WhatsAppImages.exe
1384	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1384	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
1436	WhatsAppImages.exe
744	WhatsAppImages.exe
1516	NAPSTAT.EXE
1516	NAPSTAT.EXE
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1544	WhatsAppImages.exe
1544	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1672	WhatsAppImages.exe
1792	WhatsAppImages.exe
1332	wininit.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
308	WhatsAppImages.exe
1284	WhatsAppImages.exe
308	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1516	NAPSTAT.EXE
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1516	NAPSTAT.EXE
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
308	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
1284	WhatsAppImages.exe
856	WhatsAppImages.exe
1532	NAPSTAT.EXE
1516	NAPSTAT.EXE
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1576	WhatsAppImages.exe
1576	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1516	NAPSTAT.EXE
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1612	WhatsAppImages.exe
1500	WhatsAppImages.exe
1540	explorer.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1884	WhatsAppImages.exe
1860	WhatsAppImages.exe
1884	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1860	WhatsAppImages.exe
1956	WhatsAppImages.exe
1968	control.exe
1516	NAPSTAT.EXE
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1936	WhatsAppImages.exe
1936	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1516	NAPSTAT.EXE
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1936	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1516	NAPSTAT.EXE
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1064	WhatsAppImages.exe
1736	WhatsAppImages.exe
336	svchost.exe
1516	NAPSTAT.EXE
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
612	WhatsAppImages.exe
1480	WhatsAppImages.exe
612	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1516	NAPSTAT.EXE
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1480	WhatsAppImages.exe
1420	WhatsAppImages.exe
1264	colorcpl.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1444	WhatsAppImages.exe
1444	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1516	NAPSTAT.EXE
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1096	WhatsAppImages.exe
1072	WhatsAppImages.exe
1660	chkdsk.exe
1516	NAPSTAT.EXE
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1336	WhatsAppImages.exe
1336	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1516	NAPSTAT.EXE
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
1664	WhatsAppImages.exe
644	WhatsAppImages.exe
1036	svchost.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1788	WhatsAppImages.exe
1788	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1260	WhatsAppImages.exe
1600	WhatsAppImages.exe
752	msdt.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1496	WhatsAppImages.exe
1496	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1516	NAPSTAT.EXE
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1904	WhatsAppImages.exe
1948	WhatsAppImages.exe
1920	msiexec.exe
1516	NAPSTAT.EXE
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
2020	WhatsAppImages.exe
840	WhatsAppImages.exe
2020	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
1516	NAPSTAT.EXE
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
2020	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
840	WhatsAppImages.exe
1516	NAPSTAT.EXE
840	WhatsAppImages.exe
2012	WhatsAppImages.exe
1668	cmmon32.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1472	WhatsAppImages.exe
1472	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1516	NAPSTAT.EXE
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1524	WhatsAppImages.exe
1512	WhatsAppImages.exe
1520	netsh.exe
1516	NAPSTAT.EXE
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1420	WhatsAppImages.exe
1420	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1516	NAPSTAT.EXE
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1420	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1516	NAPSTAT.EXE
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1608	WhatsAppImages.exe
1636	WhatsAppImages.exe
1096	msiexec.exe
1516	NAPSTAT.EXE
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1492	WhatsAppImages.exe
1492	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1516	NAPSTAT.EXE
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1492	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe
1536	WhatsAppImages.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE
1312	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Checks whether UAC is enabled
- Suspicious use of SendNotifyMessage
PID:1312
- C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
  "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- - C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
    "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: MapViewOfSection
    - Suspicious behavior: EnumeratesProcesses
    PID:1384
- - C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
    "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1384 113194
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious behavior: EnumeratesProcesses
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
      "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      PID:744
    - - C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1544 126891
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        7⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:308
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 308 134550
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        9⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1576 148232
        9⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        10⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        11⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1884 155985
        11⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        12⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        13⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1936 163567
        13⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        14⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        15⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 612 177295
        15⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        16⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        17⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1444 184861
        17⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        18⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        19⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1336 192489
        19⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        20⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        21⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1788 200086
        21⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        22⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        23⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1496 207777
        23⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        24⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        25⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 2020 215390
        25⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        26⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        27⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1472 229118
        27⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        28⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        29⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: MapViewOfSection
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1420 236825
        29⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        30⤵
        Suspicious use of SetThreadContext
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
        31⤵
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe" 2 1492 250506
        31⤵
        
        PID:1536
- C:\Windows\SysWOW64\NAPSTAT.EXE
  "C:\Windows\SysWOW64\NAPSTAT.EXE"
  2⤵
  - System policy modification
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: MapViewOfSection
  - Adds Run entry to policy start application
  PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\WhatsAppImages.exe"
    3⤵
    PID:1092
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2000
- C:\Windows\SysWOW64\wininit.exe
  "C:\Windows\SysWOW64\wininit.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1332
- C:\Windows\SysWOW64\NAPSTAT.EXE
  "C:\Windows\SysWOW64\NAPSTAT.EXE"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\SysWOW64\control.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:336
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Enumerates system info in registry
  PID:1660
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\SysWOW64\msdt.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\SysWOW64\cmmon32.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  PID:1260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-38-0x0000000000100000-0x0000000000108000-memory.dmp

Download

memory/752-64-0x0000000000330000-0x0000000000424000-memory.dmp

Download

memory/1036-56-0x00000000002F0000-0x00000000002F8000-memory.dmp

Download

memory/1096-96-0x0000000000840000-0x0000000000854000-memory.dmp

Download

memory/1264-45-0x0000000000B20000-0x0000000000B38000-memory.dmp

Download

memory/1312-36-0x00000000081C0000-0x00000000082A6000-memory.dmp

Download

memory/1312-3-0x0000000006CC0000-0x0000000006E57000-memory.dmp

Download

memory/1312-61-0x0000000008740000-0x0000000008806000-memory.dmp

Download

memory/1312-94-0x0000000008FB0000-0x0000000009082000-memory.dmp

Download

memory/1312-77-0x0000000008BD0000-0x0000000008D19000-memory.dmp

Download

memory/1332-13-0x00000000003F0000-0x000000000040A000-memory.dmp

Download

memory/1384-0-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1516-6-0x00000000009E0000-0x0000000000A26000-memory.dmp

Download

memory/1516-68-0x0000000003BA0000-0x0000000003CA9000-memory.dmp

Download

memory/1516-11-0x00000000030A0000-0x0000000003216000-memory.dmp

Download

memory/1520-89-0x0000000000A00000-0x0000000000A1B000-memory.dmp

Download

memory/1532-19-0x00000000009E0000-0x0000000000A26000-memory.dmp

Download

memory/1540-26-0x0000000000C70000-0x0000000000EF1000-memory.dmp

Download

memory/1660-50-0x0000000000CA0000-0x0000000000CA7000-memory.dmp

Download

memory/1668-79-0x0000000000920000-0x000000000092D000-memory.dmp

Download

memory/1920-72-0x0000000000BE0000-0x0000000000BF4000-memory.dmp

Download

memory/1968-31-0x00000000007E0000-0x00000000007FF000-memory.dmp

Download

memory/2000-70-0x000000013F300000-0x000000013F393000-memory.dmp

Download